PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 22,00 KB SHA-256 Hash: 1CA75E9B1761E15968D01A6E4F0A9F6CE47BA7EE4047D1533FB838F0F6AB28E2 SHA-1 Hash: 7C9EB0815C0BAFF8729ACDBE5EBFB74B77673C5C MD5 Hash: 5C00CCF456135514C591478904B146E3 Imphash: 78D78A405B4BBF889F0641CC70BDC5BA MajorOSVersion: 5 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 196C SizeOfHeaders: 400 SizeOfImage: 8000 ImageBase: 400000 Architecture: x86 ExportTable: 5D90 ImportTable: 55FC IAT: 5000 Characteristics: 103 TimeDateStamp: 50D9FE96 Date: 25/12/2012 19:29:26 File Type: EXE Number Of Sections: 4 ASLR: Disabled Section Names: .text, .rdata, .data, .CRT Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 3C00 | 1000 | 3B08 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
4000 | 1000 | 5000 | E5E |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
5000 | 600 | 6000 | 554 |
|
|
| .CRT | 0x40000040 Initialized Data Readable |
5600 | 200 | 7000 | 4 |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - D6C Code -> 558BEC81EC1001000056BE606440008BCEE84306000056E878F6FFFF59B9FC644000E8410400008945F068000100008D85F0 Assembler |PUSH EBP |MOV EBP, ESP |SUB ESP, 0X110 |PUSH ESI |MOV ESI, 0X406460 |MOV ECX, ESI |CALL 0X401FC5 |PUSH ESI |CALL 0X401000 |POP ECX |MOV ECX, 0X4064FC |CALL 0X401DD4 |MOV DWORD PTR [EBP - 0X10], EAX |PUSH 0X100 |
| Signatures |
| Rich Signature Analyzer: Code -> 38B762E27CD60CB17CD60CB17CD60CB15B1077B177D60CB17CD60DB132D60CB1628488B178D60CB162849EB17DD60CB162849DB17DD60CB1526963687CD60CB1 Footprint md5 Hash -> AD7162AA55A0546929F61400735DF603 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: Microsoft Visual C/C++(2008)[-] • PE: linker: Microsoft Linker(9.0)[-] • Entropy: 5.98375 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| Windows REG |
| SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009 SYSTEM\CurrentControlSet\Control\ProductOptions |
| File Access |
| server_test.exe \cmd.exe cmd.exe explorer.exe WINHTTP.dll SHELL32.dll ADVAPI32.dll USER32.dll KERNEL32.dll Data$$0d%c%s%c%sFile can not be open.Dat @.dat |
| Interest's Words |
| exec attrib start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Ascii | Service (CreateService) |
| Text | Ascii | Service (StartServiceCtrlDispatcher) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileA) |
| Text | Ascii | Reconnaissance (FindNextFileA) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Information used for user authentication (Credential) |
| Intelligent String |
| • .CRT • -@explorer.exe • cmd.exe isn't exist Data • \cmd.exe • KERNEL32.dll • mmmm2233mail.upgoogle.com/image/image.php |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 7B9 | 405014 | .text | CALL [static] | Indirect call to absolute memory address |
| 7FC | 405018 | .text | CALL [static] | Indirect call to absolute memory address |
| 808 | 4050E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 822 | 40501C | .text | CALL [static] | Indirect call to absolute memory address |
| 831 | 405020 | .text | CALL [static] | Indirect call to absolute memory address |
| 84F | 405024 | .text | CALL [static] | Indirect call to absolute memory address |
| 858 | 405028 | .text | CALL [static] | Indirect call to absolute memory address |
| 862 | 4050E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 892 | 4050F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 90A | 405010 | .text | CALL [static] | Indirect call to absolute memory address |
| A33 | 4050F0 | .text | CALL [static] | Indirect call to absolute memory address |
| CBE | 4050E0 | .text | CALL [static] | Indirect call to absolute memory address |
| CC7 | 4050E4 | .text | CALL [static] | Indirect call to absolute memory address |
| D18 | 40500C | .text | CALL [static] | Indirect call to absolute memory address |
| D43 | 405010 | .text | CALL [static] | Indirect call to absolute memory address |
| D57 | 4050E0 | .text | CALL [static] | Indirect call to absolute memory address |
| D62 | 4050DC | .text | CALL [static] | Indirect call to absolute memory address |
| DB2 | 4050D4 | .text | CALL [static] | Indirect call to absolute memory address |
| DBD | 4050D8 | .text | CALL [static] | Indirect call to absolute memory address |
| DC7 | 405008 | .text | CALL [static] | Indirect call to absolute memory address |
| DEB | 4050CC | .text | CALL [static] | Indirect call to absolute memory address |
| DF2 | 4050D0 | .text | CALL [static] | Indirect call to absolute memory address |
| DFF | 4050CC | .text | CALL [static] | Indirect call to absolute memory address |
| E06 | 4050C8 | .text | CALL [static] | Indirect call to absolute memory address |
| E0D | 4050CC | .text | CALL [static] | Indirect call to absolute memory address |
| E1E | 4050C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1025 | 4050BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 10B1 | 405100 | .text | CALL [static] | Indirect call to absolute memory address |
| 10D5 | 405100 | .text | CALL [static] | Indirect call to absolute memory address |
| 14FE | 40507C | .text | CALL [static] | Indirect call to absolute memory address |
| 1515 | 4050B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 154B | 40503C | .text | CALL [static] | Indirect call to absolute memory address |
| 1559 | 405004 | .text | CALL [static] | Indirect call to absolute memory address |
| 15DD | 405130 | .text | CALL [static] | Indirect call to absolute memory address |
| 15F5 | 40512C | .text | CALL [static] | Indirect call to absolute memory address |
| 1616 | 405128 | .text | CALL [static] | Indirect call to absolute memory address |
| 1630 | 405124 | .text | CALL [static] | Indirect call to absolute memory address |
| 1643 | 405120 | .text | CALL [static] | Indirect call to absolute memory address |
| 1666 | 40511C | .text | CALL [static] | Indirect call to absolute memory address |
| 16A2 | 405118 | .text | CALL [static] | Indirect call to absolute memory address |
| 16BF | 405114 | .text | CALL [static] | Indirect call to absolute memory address |
| 177C | 405134 | .text | CALL [static] | Indirect call to absolute memory address |
| 17A4 | 405104 | .text | CALL [static] | Indirect call to absolute memory address |
| 17E1 | 405130 | .text | CALL [static] | Indirect call to absolute memory address |
| 17F9 | 40512C | .text | CALL [static] | Indirect call to absolute memory address |
| 1819 | 405128 | .text | CALL [static] | Indirect call to absolute memory address |
| 1833 | 405124 | .text | CALL [static] | Indirect call to absolute memory address |
| 1843 | 405120 | .text | CALL [static] | Indirect call to absolute memory address |
| 1868 | 40511C | .text | CALL [static] | Indirect call to absolute memory address |
| 18A3 | 405118 | .text | CALL [static] | Indirect call to absolute memory address |
| 18C0 | 405114 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A2E | 405130 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A4A | 40512C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A6C | 405128 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A9B | 40513C | .text | CALL [static] | Indirect call to absolute memory address |
| 1AB0 | 405124 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AC0 | 405120 | .text | CALL [static] | Indirect call to absolute memory address |
| 1ACC | 4050E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AF7 | 40511C | .text | CALL [static] | Indirect call to absolute memory address |
| 1B34 | 405138 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B68 | 405138 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B9E | 40513C | .text | CALL [static] | Indirect call to absolute memory address |
| 1BEC | 40511C | .text | CALL [static] | Indirect call to absolute memory address |
| 1C27 | 405118 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C44 | 405114 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E40 | 405050 | .text | CALL [static] | Indirect call to absolute memory address |
| 2122 | 405054 | .text | CALL [static] | Indirect call to absolute memory address |
| 2185 | 4050F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 21E8 | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 22E1 | 40503C | .text | CALL [static] | Indirect call to absolute memory address |
| 22ED | 405004 | .text | CALL [static] | Indirect call to absolute memory address |
| 230A | 4050DC | .text | CALL [static] | Indirect call to absolute memory address |
| 2327 | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 23BC | 405134 | .text | CALL [static] | Indirect call to absolute memory address |
| 24E9 | 405058 | .text | CALL [static] | Indirect call to absolute memory address |
| 2514 | 405058 | .text | CALL [static] | Indirect call to absolute memory address |
| 256B | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2654 | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 267B | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 27A2 | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2895 | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 295B | 40505C | .text | CALL [static] | Indirect call to absolute memory address |
| 296A | 4050F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2979 | 405000 | .text | CALL [static] | Indirect call to absolute memory address |
| 29DF | 4050B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2ADB | 4050F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B62 | 405060 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D43 | 405070 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D86 | 40506C | .text | CALL [static] | Indirect call to absolute memory address |
| 2F37 | 40506C | .text | CALL [static] | Indirect call to absolute memory address |
| 2F51 | 405064 | .text | CALL [static] | Indirect call to absolute memory address |
| 3029 | 405074 | .text | CALL [static] | Indirect call to absolute memory address |
| 309F | 4050C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 30AF | 4050DC | .text | CALL [static] | Indirect call to absolute memory address |
| 317F | 405074 | .text | CALL [static] | Indirect call to absolute memory address |
| 3211 | 4050EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3330 | 4050DC | .text | CALL [static] | Indirect call to absolute memory address |
| 33FE | 4050E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3405 | 4050DC | .text | CALL [static] | Indirect call to absolute memory address |
| 3455 | 405098 | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 12220 | 54,2436% |
| Null Byte Code | 4558 | 20,2326% |
© 2026 All rights reserved.